Vulnerabilities
Summary — last 7 days
New vulnerabilities5,213▲ 2,470 vs. last week
Critical / high2,931▲ 1,605 vs. last week
New active exploitation (KEV)11▲ 7 vs. last week
Unscored (no CVSS)217▲ 43 vs. last week
408,072 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (9.3) | 0.24% | — | Multinet Interactive AB Eduadmin BookingAI | 10/9/2026 | 10/11/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0. | |
| Deferred | High (7.1) | 0.14% | — | Welcart E CommerceAI | 10/9/2026 | 10/9/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3. | |
| Deferred | High (8.8) | 0.13% | — | Fifu Featured Image From URLAI | 10/9/2026 | 10/9/2026 | Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7. | |
| Deferred | High (7.1) | 0.14% | — | Basix NEX FormsAI | 10/9/2026 | 10/9/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1. | |
| Deferred | High (7.1) | 0.15% | — | FibosearchAI | 10/9/2026 | 10/11/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1. | |
| Deferred | Medium (5.6) | 0.15% | — | Ultimatemember Ultimate MemberAI | 10/9/2026 | 10/11/2026 | Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1. | |
| Deferred | Medium (5.9) | 0.18% | — | Properfraction ProfilepressAI | 10/9/2026 | 10/9/2026 | Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3. | |
| Deferred | High (7.5) | 0.20% | — | TMS AmeliaAI | 10/9/2026 | 10/9/2026 | Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10. | |
| Deferred | Medium (6.5) | 0.17% | — | Properfraction ProfilepressAI | 10/9/2026 | 10/9/2026 | Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3. | |
| Deferred | High (7.5) | 0.27% | — | Wpmudev ForminatorAI | 10/9/2026 | 10/11/2026 | Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2. | |
| Deferred | Medium (5.6) | 0.15% | — | Themegrill User RegistrationAI | 10/9/2026 | 10/11/2026 | Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7. | |
| Deferred | High (7.5) | 0.27% | — | Stellarwp GivewpAI | 10/9/2026 | 10/9/2026 | Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1. | |
| Deferred | High (7.1) | 0.14% | — | Idokd Simple PaymentAI | 10/9/2026 | 10/9/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4. | |
| Deferred | Critical (9.3) | 0.24% | — | Wpdreams Ajax Search PROAI | 10/9/2026 | 10/9/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1. | |
| Deferred | Critical (9.3) | 0.23% | — | Tagdiv OPT IN BuilderAI | 10/9/2026 | 10/11/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6. | |
| Deferred | High (8.5) | 0.21% | — | Tagdiv OPT IN BuilderAI | 10/9/2026 | 10/11/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6. | |
| Deferred | Critical (9.3) | 0.23% | — | Jegtheme Jnews PAY WriterAI | 10/9/2026 | 10/9/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1. | |
| Deferred | Critical (9.3) | 0.25% | — | Vibethemes WplmsAI | 10/9/2026 | 10/9/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2. | |
| Deferred | High (8.5) | 0.21% | — | Upsolution CoreAI | 10/9/2026 | 10/9/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3. | |
| Deferred | High (7.1) | 0.18% | — | Davidlingren Media Library AssistantAI | 10/9/2026 | 10/11/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41. | |
| Deferred | High (7.1) | 0.18% | — | Pluginus NET HuskyAI | 10/9/2026 | 10/11/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2. | |
| Deferred | High (8.5) | 0.21% | — | Vibethemes WplmsAI | 10/9/2026 | 10/9/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973. | |
| Deferred | High (8.5) | 0.21% | — | TaskbuilderAI | 10/9/2026 | 10/9/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5. | |
| Deferred | High (7.1) | 0.18% | — | Codepeople Search IN PlaceAI | 10/9/2026 | 10/9/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5. | |
| Deferred | Medium (6.5) | 0.24% | — | Codemstory Pgall FOR WoocommerceAI | 10/9/2026 | 10/11/2026 | Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17. |